{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33791", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "state": "PUBLISHED", "assignerShortName": "juniper", "dateReserved": "2026-03-23T19:46:13.672Z", "datePublished": "2026-04-09T21:38:52.747Z", "dateUpdated": "2026-04-09T21:38:52.747Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Junos OS", "vendor": "Juniper Networks", "versions": [{"lessThan": "22.4R3-S8", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "23.2R2-S5", "status": "affected", "version": "23.2", "versionType": "semver"}, {"lessThan": "23.4R2-S7", "status": "affected", "version": "23.4", "versionType": "semver"}, {"lessThan": "24.2R2-S2", "status": "affected", "version": "24.2", "versionType": "semver"}, {"lessThan": "24.4R2", "status": "affected", "version": "24.4", "versionType": "semver"}, {"lessThan": "25.2R2", "status": "affected", "version": "25.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Junos OS Evolved", "vendor": "Juniper Networks", "versions": [{"lessThan": "22.4R3-S8-EVO", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "23.2R2-S5-EVO", "status": "affected", "version": "23.2", "versionType": "semver"}, {"lessThan": "23.4R2-S7-EVO", "status": "affected", "version": "23.4", "versionType": "semver"}, {"lessThan": "24.2R2-S2-EVO", "status": "affected", "version": "24.2", "versionType": "semver"}, {"lessThan": "24.4R2-EVO", "status": "affected", "version": "24.4", "versionType": "semver"}, {"lessThan": "25.2R1-S1-EVO, 25.2R2-EVO", "status": "affected", "version": "25.2", "versionType": "semver"}]}], "datePublic": "2026-04-08T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete compromise of the system.<br><br>Certain 'set system' commands, when executed with crafted arguments, are not properly sanitized, allowing for arbitrary shell injection. These shell commands are executed as root, potentially allowing for complete control of the vulnerable system.<br><p>This issue affects:</p><p>Junos OS:&nbsp;</p><p></p><ul><li>all versions before 22.4R3-S8,&nbsp;</li><li>from 23.2 before 23.2R2-S5,&nbsp;</li><li>from 23.4 before 23.4R2-S7,&nbsp;</li><li>from 24.2 before 24.2R2-S2,&nbsp;</li><li>from 24.4 before 24.4R2,&nbsp;</li><li>from 25.2 before 25.2R2;&nbsp;</li></ul><p></p><p>Junos OS Evolved:&nbsp;</p><p></p><ul><li>all versions before 22.4R3-S8-EVO,&nbsp;</li><li>from 23.2 before 23.2R2-S5-EVO,&nbsp;</li><li>from 23.4 before 23.4R2-S7-EVO,&nbsp;</li><li>from 24.2 before 24.2R2-S2-EVO,&nbsp;</li><li>from 24.4 before 24.4R2-EVO,&nbsp;</li><li>from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.</li></ul><p></p>"}], "value": "An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete compromise of the system.\n\nCertain 'set system' commands, when executed with crafted arguments, are not properly sanitized, allowing for arbitrary shell injection. These shell commands are executed as root, potentially allowing for complete control of the vulnerable system.\nThis issue affects:\n\nJunos OS:\u00a0\n\n\n\n * all versions before 22.4R3-S8,\u00a0\n * from 23.2 before 23.2R2-S5,\u00a0\n * from 23.4 before 23.4R2-S7,\u00a0\n * from 24.2 before 24.2R2-S2,\u00a0\n * from 24.4 before 24.4R2,\u00a0\n * from 25.2 before 25.2R2;\u00a0\n\n\n\n\nJunos OS Evolved:\u00a0\n\n\n\n * all versions before 22.4R3-S8-EVO,\u00a0\n * from 23.2 before 23.2R2-S5-EVO,\u00a0\n * from 23.4 before 23.4R2-S7-EVO,\u00a0\n * from 24.2 before 24.2R2-S2-EVO,\u00a0\n * from 24.4 before 24.4R2-EVO,\u00a0\n * from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.4, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2026-04-09T21:38:52.747Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://kb.juniper.net/JSA107875"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The following software releases have been updated to resolve this specific issue: <br>Junos OS 22.4R3-S8, 23.2R2-S5, 23.4R2-S7, 24.2R2-S2, 24.4R2, 25.2R2, 25.4R1<span style=\"background-color: rgb(255, 255, 255);\">, and all subsequent releases.</span>\n\n<br>\n\n<span style=\"background-color: rgb(255, 255, 255);\">Junos OS Evolved 22.4R3-S8-EVO, 23.2R2-S5-EVO, 23.4R2-S7-EVO, 24.2R2-S2-EVO, 24.4R2-EVO, 25.2R1-S1-EVO, 25.2R2-EVO, 25.4R1-EVO<span style=\"background-color: rgb(255, 255, 255);\">, and all subsequent releases.</span>\n\n</span><br>"}], "value": "The following software releases have been updated to resolve this specific issue: \nJunos OS 22.4R3-S8, 23.2R2-S5, 23.4R2-S7, 24.2R2-S2, 24.4R2, 25.2R2, 25.4R1, and all subsequent releases.\n\n\n\n\nJunos OS Evolved 22.4R3-S8-EVO, 23.2R2-S5-EVO, 23.4R2-S7-EVO, 24.2R2-S2-EVO, 24.4R2-EVO, 25.2R1-S1-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases."}], "source": {"advisory": "JSA107875", "defect": ["1872082"], "discovery": "INTERNAL"}, "title": "Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as root", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "One of the following mitigations will reduce the risk of malicious exploitation:<br><ul><li>Use access lists or firewall filters to limit access to the CLI only from trusted hosts and administrators.</li><li>Avoid configuring access to any part of the '<tt>set system</tt>'\u200b stanza for non-privileged users.</li></ul>"}], "value": "One of the following mitigations will reduce the risk of malicious exploitation:\n * Use access lists or firewall filters to limit access to the CLI only from trusted hosts and administrators.\n * Avoid configuring access to any part of the 'set system'\u200b stanza for non-privileged users."}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete compromise of the system.\n\nCertain 'set system' commands, when executed with crafted arguments, are not properly sanitized, allowing for arbitrary shell injection. These shell commands are executed as root, potentially allowing for complete control of the vulnerable system.\nThis issue affects:\n\nJunos OS:\u00a0\n\n\n\n * all versions before 22.4R3-S8,\u00a0\n * from 23.2 before 23.2R2-S5,\u00a0\n * from 23.4 before 23.4R2-S7,\u00a0\n * from 24.2 before 24.2R2-S2,\u00a0\n * from 24.4 before 24.4R2,\u00a0\n * from 25.2 before 25.2R2;\u00a0\n\n\n\n\nJunos OS Evolved:\u00a0\n\n\n\n * all versions before 22.4R3-S8-EVO,\u00a0\n * from 23.2 before 23.2R2-S5-EVO,\u00a0\n * from 23.4 before 23.4R2-S7-EVO,\u00a0\n * from 24.2 before 24.2R2-S2-EVO,\u00a0\n * from 24.4 before 24.4R2-EVO,\u00a0\n * from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO."}], "id": "CVE-2026-33791", "lastModified": "2026-04-09T22:16:29.047", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "sirt@juniper.net", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "sirt@juniper.net", "type": "Secondary"}]}, "published": "2026-04-09T22:16:29.047", "references": [{"source": "sirt@juniper.net", "url": "https://kb.juniper.net/JSA107875"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "sirt@juniper.net", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,22.4R3-S8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[23.2,23.2R2-S5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[23.4,23.4R2-S7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[24.2,24.2R2-S2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[24.4,24.4R2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[25.2,25.2R2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Junos OS", "source": "cna", "vendor": "Juniper Networks"}, "product": "junos_os", "vendor": "juniper_networks"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,22.4R3-S8-EVO)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[23.2,23.2R2-S5-EVO)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[23.4,23.4R2-S7-EVO)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[24.2,24.2R2-S2-EVO)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[24.4,24.4R2-EVO)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[25.2,25.2R1-S1-EVO)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[25.2,25.2R2-EVO)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Junos OS Evolved", "source": "cna", "vendor": "Juniper Networks"}, "product": "junos_os_evolved", "vendor": "juniper_networks"}], "analysis": {"en": {"generated_at": "2026-04-09T23:23:52.332053+00:00", "value": {"mitigation_remediation": ["Apply the latest Junos OS or Junos OS Evolved releases (22.4R3\u2011S8, 23.2R2\u2011S5, 23.4R2\u2011S7, 24.2R2\u2011S2, 24.4R2, 25.2R2, and all subsequent versions).", "If patching is delayed, limit CLI access to trusted hosts and administrators using access lists or firewall filters to reduce exposure.", "Restrict non\u2011privileged users from accessing any part of the 'set system' configuration stanza to prevent potential exploitation."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary Shell Injection as Root"}, "threat_synthesis": {"affected_systems": "Affected products are Juniper Networks Junos OS and Junos OS Evolved. Vulnerable versions include all releases before 22.4R3\u2011S8, before 23.2R2\u2011S5, before 23.4R2\u2011S7, before 24.2R2\u2011S2, before 24.4R2, and before 25.2R2 for Junos OS, and the corresponding Evolved series before 22.4R3\u2011S8\u2011EVO, before 23.2R2\u2011S5\u2011EVO, before 23.4R2\u2011S7\u2011EVO, before 24.2R2\u2011S2\u2011EVO, before 24.4R2\u2011EVO, before 25.2R1\u2011S1\u2011EVO, and before 25.2R2\u2011EVO.", "description_and_impact": "An OS command injection flaw in Juniper Networks Junos OS and Junos OS Evolved allows a local high\u2011privileged attacker to inject arbitrary shell commands by entering crafted 'set system' CLI commands. This vulnerability, classified as CWE\u201178, grants root\u2011level execution and can lead to complete compromise of the device, impacting confidentiality, integrity, and availability.", "risk_and_exploitability": "The CVSS score of 8.4 indicates a high severity vulnerability. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the risk remains significant because an attacker with local, high\u2011privileged access can exploit the flaw by entering crafted CLI commands. Successful exploitation grants unrestricted root command execution, enabling a full system takeover."}}}}, "created": "2026-04-10T08:36:49.338758+00:00", "updated": "2026-04-10T09:27:46.096496+00:00", "vendors": ["juniper_networks", "juniper_networks$PRODUCT$junos_os", "juniper_networks$PRODUCT$junos_os_evolved"]}